teamhanko / passkeys

FIDO2-certified passkey server and SDKs for adding passkey support to any auth system
https://hanko.io/passkey-api
GNU Affero General Public License v3.0
115 stars 8 forks source link

Rework/Rethink handling of errors #18

Closed FreddyDevelop closed 9 months ago

FreddyDevelop commented 10 months ago

Currently when an error is returned sometimes the internal error is returned in the additional property and sometimes the error is added to the details property.

Also the internal error is not logged in the request log, although it has an error property, which is not used.

Also we should rethink if we want to return every error to the caller or if we should only show the internal errors in the logs.

shentschel commented 10 months ago

I question which came directly into my mind: How much information do we want to provide for recovering in a case of an error?

FreddyDevelop commented 10 months ago

IMO we should provide information when the user needs to do something (e.g. missing property) but not when something underlying (e.g. DB is not available) is broken. But we do not need to show information like uuid: incorrect UUID length %d in string %q, in this case I think the user only need to know, that the uuid is incorrect.

shentschel commented 9 months ago

I think I will also rework the structure of the server to reflect those changes and increase the readability.

I thought of the following structure:

server
  --> handler <-- Checks if a request is valid and also creates the audit log
    --> service <-- Does all business logic like login or registration

That should also improve readability and maintainability,

Any thoughts before I start the rework?

FreddyDevelop commented 9 months ago

No, no thoughts on that, except it is always nice when the readability increases.